Dir 816 Firmware CVE-2025-5623

This vulnerability presents CRITICAL real-world risk justified by multiple corroborating signals: (1) CVSS 9.8 with all impact metrics at HIGH (C:H/I:H/A:H) and minimal attack complexity (AC:L, PR:N, UI:N) indicates trivial exploitation; (2) Public proof-of-concept disclosure dramatically increases EPSS probability—while specific EPSS score is not provided, public POC availability typically correlates with 80%+ exploitation probability; (3) End-of-life product status (no maintainer support) means zero likelihood of vendor patches, leaving all deployed instances permanently vulnerable; (4) Stack-based buffer overflow enables arbitrary code execution, the highest technical impact; (5) Network accessibility (AV:N) with no authentication requirement (PR:N) removes all access barriers. The primary risk mitigation factor is product age and declining deployment numbers, but organizations still operating legacy DIR-816 units in production face unmitigated critical risk. This is NOT a high-CVSS-but-low-risk scenario—it is a genuine critical priority for affected organizations.

An unauthenticated remote attacker on the internet identifies a D-Link DIR-816 1.10CNB05 device by scanning for the characteristic HTTP response signatures or via Shodan queries. The attacker crafts a malicious HTTP POST request to /goform/qosClassifier with an oversized dip_address or sip_address parameter (e.g., 1000+ bytes) containing shellcode. The vulnerable qosClassifier function copies this input into a fixed-size stack buffer without bounds validation, causing a stack overflow that overwrites the return address. Upon function return, execution jumps to attacker-controlled shellcode, granting arbitrary code execution with root privileges (the web service typically runs as root on embedded devices). The attacker uses this access to install persistent backdoors, exfiltrate network traffic, pivot to internal networks, or render the device inoperable (DoS). The attack requires no authentication, user interaction, or special network access—a single HTTP request from the internet suffices. Public POC code availability and simplicity of exploitation (AC:L, UI:N) mean this attack can be automated and weaponized at scale.